Ṣọ Shield API Terms

These API Terms govern:

• ▸The Ṣọ Shield API, served at api-service.soone.soemailsecurity.com, including all endpoints, responses, and documentation.
• ▸The developer dashboard, where you create and manage API keys, view usage, and manage your plan.
• ▸Any sandbox or test environment we make available for development.

By creating an API key or sending a request to the API, you accept these API Terms. If you are accepting on behalf of an organisation, you confirm you have authority to bind it.

• ▸Keys are issued in the developer dashboard. Production keys begin with so_live_. Sandbox keys begin with so_test_.
• ▸A key is shown in full once, at the moment it is created. We store only a one-way hash of the key and a short display prefix so you can tell your keys apart. We cannot recover a lost key, so you will need to create a new one.
• ▸You are responsible for keeping keys secret. Do not put a production key in client-side code, a mobile app binary, a public repository, or a support ticket.
• ▸All activity on a key is treated as your activity, and credits used on a key are billed to you.
• ▸You can rotate or revoke a key at any time in the dashboard. We may rotate or revoke a key if we believe it has been exposed, is being abused, or is being used in breach of these API Terms. Where practical we will tell you first.
• ▸Tell us promptly at sales@soemailsecurity.com if you believe a key has been exposed.

Requests that fail because of a fault on our side are not intended to consume credits. If they do, we will credit your account on request.

• ▸Hourly and daily request limits apply to each plan. Current limits are shown in the developer documentation and in your dashboard.
• ▸Requests over the limit are rejected with HTTP status 429. Build retry and backoff handling into your integration.
• ▸Sandbox keys are not rate limited. They are for development and testing only, must not be used in production, and their responses must not be relied on for real security decisions.
• ▸We may apply short-term limits to protect the service for everyone, including during an incident or an unusual traffic spike.

• ▸Roles. You are the controller of the content you submit to the API. We act as your processor for that content and process it only to return a result to you and to run the service.
• ▸Your responsibility. You must have the legal right and any consents or notices needed to submit the content, including content that belongs to your own end users or employees. You must not submit content you have no right to submit.
• ▸Content is not stored. Submitted content, including email bodies, headers, documents, URLs, and images, is analysed in memory and is not written to persistent storage by the API.
• ▸Metadata is retained. We retain request metadata such as timestamp, endpoint, key identifier, credits used, and response status. We need it for usage accounting, billing, abuse prevention, and debugging.
• ▸Data processing terms. For enterprise and partner use, a Data Processing Agreement applies. A draft is published at soemailsecurity.com/dpa. Request the signed version from sales@soemailsecurity.com.

You must not:

• ▸Submit content you do not have the legal right or the necessary consents to submit.
• ▸Reverse engineer, decompile, or try to extract the models, rules, weights, or source behind the API.
• ▸Run benchmarks or comparative tests and publish the results without our written consent. Ask us and we will usually say yes, and we would like the chance to check the methodology first.
• ▸Use the API to build, train, or enrich a competing threat-detection dataset, model, or service.
• ▸Circumvent rate limits or credit accounting, including by creating multiple accounts, sharing keys, or spreading traffic across keys to avoid a limit.
• ▸Use the API for anything unlawful, or to build a product whose purpose is unlawful.
• ▸Interfere with the service, probe it for weaknesses without written permission, or use it to attack anyone.
• ▸Present API results as your own detection technology in a way that misleads your users about who performs the analysis, where a signed agreement does not permit it.

• ▸We offer no uptime commitment on self-serve plans, including Free, Starter, Growth, and Pro. We work to keep the API available and we do not promise a service level on these plans.
• ▸Uptime commitments, support response times, and remedies for enterprise customers are set out in a separate signed agreement.
• ▸Features labelled alpha, beta, preview, or early access are provided as is. They may change or be withdrawn at any time and are excluded from any uptime or support commitment.
• ▸We may change endpoints, response shapes, and credit costs. For changes that break existing integrations we will give reasonable notice through the developer documentation and to the email on your account.

• ▸Changes to these terms. We may update these API Terms. Material changes will be sent to the email on your account with reasonable notice before they take effect. Continued use after that date means you accept the new version.
• ▸Suspension. We may suspend or limit API access for abuse, unlawful use, a security risk to the service or other customers, or non-payment. Where practical we will contact you first. For a serious or ongoing risk we may act immediately and explain afterwards.
• ▸Your cancellation. You may cancel at any time in the developer dashboard. Cancellation takes effect at the end of the current billing period. Fees already paid are non-refundable except as required by law or as stated in our Terms of Service.
• ▸Effect of termination. On termination or non-payment, your keys stop working and in-flight requests will fail. Remove the integration from anything that depends on it. We keep billing and usage records as required by law and as described in our Privacy Policy.